Windows Process: winget adds new download source via 'source add' with IP/endpoint
Alerts on winget.exe being used to add a new package download source specified by an IP address.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of winget.exe where the command line includes both 'source ' and 'add ' and the specified source contains an IP-based endpoint. Adding new package sources can enable attackers to redirect installations to malicious content. The detection relies on Windows process creation telemetry, matching the executable name and parsing the command line for the relevant 'source add' activity and an IP address pattern.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/package-manager/winget/source
- github.comhttps://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: winget adds new download source via 'source add' with IP/endpoint"
id: 0dc7943d-c4a0-4805-b41b-c4575a508904
related:
- id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
type: similar
- id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
type: similar
- id: c15a46a0-07d4-4c87-b4b6-89207835a83b
type: derived
status: test
description: This rule flags process executions of winget.exe where the command line includes both 'source ' and 'add ' and the specified source contains an IP-based endpoint. Adding new package sources can enable attackers to redirect installations to malicious content. The detection relies on Windows process creation telemetry, matching the executable name and parsing the command line for the relevant 'source add' activity and an IP address pattern.
references:
- https://learn.microsoft.com/en-us/windows/package-manager/winget/source
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-12-04
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \winget.exe
- OriginalFileName: winget.exe
selection_cli:
CommandLine|contains|all:
- "source "
- "add "
selection_source_direct_ip:
CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1